Incident Response Planning & Coordination Flashcards
7 cards from real CIM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Incident Response Planning & Coordination flashcards as text
During a major incident, the Incident Manager notices that two resolver groups are working on the same component without awareness of each other. What coordination action should be taken first?
Answer: Establish a bridge call to synchronize both groups under unified command
A bridge call unifies resolver groups under a single communication channel, preventing duplicated effort and potential conflicting changes.
Which element of an Incident Response Plan defines who has authority to declare a Major Incident?
Answer: Declaration criteria and authority section
The declaration criteria and authority section specifies thresholds and which roles are empowered to officially declare a major incident.
A CIM candidate is reviewing a post-incident report and finds the 'timeline of events' section is missing. Why is this section critical?
Answer: It enables root cause analysis and reveals coordination gaps during the incident
A chronological timeline exposes decision points, delays, and coordination failures that inform prevention and process improvements.
When an incident affects multiple business units simultaneously, which coordination model is most effective for the Incident Manager?
Answer: Centralized command with designated liaisons from each business unit
Centralized command with business unit liaisons ensures consistent messaging, avoids conflicting remediation actions, and provides a single point of authority.
What is the primary purpose of a 'war room' or virtual command center during a major incident?
Answer: To provide a dedicated, real-time collaboration space for all key responders
A war room concentrates decision-makers and resolvers in one environment to accelerate communication, reduce handoff delays, and enable rapid coordinated response.
An organization's incident response plan has not been tested in 18 months. What is the MOST significant risk of an untested plan?
Answer: The plan may reference outdated contact information, roles, or procedures that no longer reflect reality
Untested plans frequently contain stale contact lists, changed responsibilities, and obsolete procedures that cause failures when real incidents occur.
Which metric BEST measures the effectiveness of incident coordination during a major incident?
Answer: Mean Time to Restore (MTTR) compared against SLA targets
MTTR directly reflects how efficiently coordination activities accelerated restoration, making it the most meaningful coordination effectiveness metric.